Wondering how to log suspicious martian packets? We can help you.

A Martian packet is an IP packet that specifies a source or destination address that is reserved for special-use by Internet Assigned Numbers Authority (IANA).

Often martian and unroutable packets get used for a dangerous purpose or DoS/DDOS to our server. So, it is important to drop the bad martian packet earlier and log into our server for further inspection.

Her at Bobcares, we assist our customers to log suspicious Martian packets on their Linux servers as a part of our Server Management Services.

Today let’s see in detail regarding the Martian packet and the steps that our Support Techs follow to log them.

How to Log Suspicious Martian Packets.

Before going to the steps to log suspicious Martian packets, we will see what are Martian and log suspicious Martian packets.

Martian: A packet sent on a TCP/IP network with a source address of the test loopback interface [127.0.0.1]. This means that it will come back labeled with a source address that is clearly not of this earth.

Linux: Log Suspicious Martian Packets

On the public Internet, Martian packet’s source address is either spoofed and cannot originate as claimed, or the packet cannot be delivered. Both IPv4 and IPv6, martian packets have source or destination addresses within special-use ranges as per RFC 6890.

Some examples for source or destination address that is reserved for special-use by IANA are given below:

10.0.0.0/8
100.64.0.0/10
172.16.0.0/12
192.0.0.0/24
192.168.0.0/16
127.0.0.0/8
224.0.0.0/4
240.0.0.0/4
::/128
::/96
::1/128

Steps to log Martian packets on Linux

Firstly, we will use sysctl command to view or set Linux kernel variables that can log packets with un-routable source addresses to the kernel log file such as /var/log/messages.

To check the current settings we can use the following sysctl command with sudo command or run it as the root user:

# sysctl -a| grep martians
$ sudo sysctl -a| grep martians

Value 0 indicates that the suspicious martian packets are not logged on the system.

However, to log suspicious martian packets on Linux, we need to set the following variables to 1 in /etc/sysctl.conf file:

* net.ipv4.conf.all.log_martians
* net.ipv4.conf.default.log_martians

We can use the following commands:

# vi /etc/sysctl.conf

And edit the following lines:

net.ipv4.conf.all.log_martians=1
net.ipv4.conf.default.log_martians=1

We can now save and close the file.

To load changes made we can use the following command:

# sysctl -p

How to modify active kernel parameters on the command line

Alternatively, we can toggle active kernel parameters using the following bash for loop syntax:

## Grab all Linux kernel vars in $x ##
x=$(sysctl -a| grep martians | awk ‘{ print $1}’)
## Just display it on screen ##
echo “$x”

## Alright, toggle all vars to 1 or 0 as per your requirements ##
for i in $x
do
/sbin/sysctl -w ${i}=1
done

## Verify settings ##
sysctl -a| grep martians

How to see logged suspicious martian packets logs on Linux

We can use the following grep command:

cd /var/log
grep -i –color martian messages*

Sample outputs:

messages-20120101:Mar 20 09:25:45 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.106.25, on dev eth1
messages-20120101:Mar 20 09:25:53 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.106.25, on dev eth1
messages-20120101:Mar 20 09:26:10 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.106.25, on dev eth1
messages-20120101:Mar 20 14:04:12 bobcares-router kernel: martian source 74.xx.47.yy from 10.1.97.141, on dev eth1
messages-20120101:Mar 20 14:04:14 bobcares-router kernel: martian source 74.xx.47.yy from 10.1.97.141, on dev eth1
messages-20120101:Mar 20 14:04:18 bobcares-router kernel: martian source 74.xx.47.yy from 10.1.97.141, on dev eth1
messages-20120101:Mar 20 14:04:22 bobcares-router kernel: martian source 74.xx.47.yy from 10.1.97.141, on dev eth1
messages-20120101:Mar 20 14:04:26 bobcares-router kernel: martian source 74.xx.47.yy from 10.1.97.141, on dev eth1
messages-20120101:Mar 20 14:04:34 bobcares-router kernel: martian source 74.xx.47.yy from 10.1.97.141, on dev eth1
messages-20120101:Mar 20 14:04:50 bobcares-router kernel: martian source 74.xx.47.yy from 10.1.97.141, on dev eth1
messages-20120101:Mar 21 00:01:59 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1
messages-20120101:Mar 21 00:02:00 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1
messages-20120101:Mar 21 00:02:02 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1
messages-20120101:Mar 21 00:02:06 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1
messages-20120101:Mar 21 00:02:10 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1
messages-20120101:Mar 21 00:02:14 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1
messages-20120101:Mar 21 00:02:22 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1
messages-20120101:Mar 21 00:02:38 bobcares-router kernel: martian source 74.xx.47.yy from 10.13.105.141, on dev eth1

How to block martian packets using the firewall

Spoofing and bad address attacks try to fool the server and try to claim that packets had come from a local address/network.

Following IP/network address are known to open this kind of attack:

Incoming source IP address is the server’s IP address.

Following are some ranges of bad incoming address:

* 0.0.0.0/8
* 127.0.0.0/8
* 10.0.0.0/8
* 172.16.0.0/12
* 192.168.0.0/16
* 192.168.0.0/16
* 224.0.0.0/3
* Our own internal server/network IP address/ranges.

We can use the following small shell script that will try to prevent this kind of attacks:

#!/bin/bash

INT_IF=”eth1″ # connected to internet
SERVER_IP=”202.54.10.20″ # server IP
LAN_RANGE=”192.168.1.0/24″ # your LAN IP range

# Add your spoofed IP range/IPs here
SPOOF_IPS=”0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3″

IPT=”/sbin/iptables” # path to iptables

# default action, can be DROP or REJECT
ACTION=”DROP”

# Drop packet that claiming from our own server on WAN port
$IPT -A INPUT -i $INT_IF -s $SERVER_IP -j $ACTION
$IPT -A OUTPUT -o $INT_IF -s $SERVER_IP -j $ACTION

# Drop packet that claiming from our own internal LAN on WAN port
$IPT -A INPUT -i $INT_IF -s $LAN_RANGE -j $ACTION
$IPT -A OUTPUT -o $INT_IF -s $LAN_RANGE -j $ACTION

## Drop all spoofed
for ip in $SPOOF_IPS
do
$IPT -A INPUT -i $INT_IF -s $ip -j $ACTION
$IPT -A OUTPUT -o $INT_IF -s $ip -j $ACTION
done
## add or call your rest of script below to customize iptables ##

After adding the code, save and close the file.

We can call the above script from our own iptables script by adding the following line to our /etc/sysctl.conf file:

net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.all.log_martians=1
net.ipv4.conf.default.log_martians=1

The net.ipv4.conf.all.rp_filter=1 entry enables source address verification which is inbuilt into the Linux kernel itself and the last two lines logs all such spoofed packets in the log file.

[Need Assistance? We are available 24*7]

Conclusion

In short, we saw the steps that our Support Engineers follow to block and log suspicious martian packets on Linux servers.